News for hackers. Stuff that matters.

A comment on Why does APT not use HTTPS?. Parent comment

Re:Why does APT not use HTTPS? by Ajedi32 on Monday January 21, 2019 @09:47AM (#18960678)
That doesn't sound like an argument against it to me. It just means that in addition to HTTPS, they also need to make "significant other changes the architecture".
[ Parent | on HN ]
Re:Why does APT not use HTTPS? by brazzy on Monday January 21, 2019 @10:59AM (#18961182)
...which would be a huge undertaking given the vast installed base and the fact that packet sources currently don't run any custom server software at all, which would need to change.
[ Parent | on HN ]
Re:Why does APT not use HTTPS? by Ajedi32 on Monday January 21, 2019 @12:11PM (#18961733)
I'm not so sure about that. Assuming all the packages are downloaded over a single connection, you can easily pad the response client-side via HTTP range requests, for example. No special server software required; just a normal HTTP server.
[ Parent | on HN ]